Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 746 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

W32.Aliz.Worm not detected bij ASL

Poincare
It seems that Astaro does NOT detect e-mails with the W32.Aliz.Worm virus. Lucky that our workstations have Norton Anti Virus running that
DOES detect the virus. If you read the documentation at: http://securityresponse.symantec.com/avcenter/venc/data/w32.aliz.worm.html you can see that this virus was already reported on May 22nd 2001. Anyway, it shouldn't pass the smtp-virus scanner...
The virus is sent as a "whatever.exe" attachment, but we adapted /var/chroot/smtp/var/spool/qmailscan so that all files with a .exe, .com, .vbs, .mp3, .avi, ... are blocked. This works fine for "normal" e-mails but not for this one.
Summarized:
- ASL does not detect the W32.Aliz.Worm virus
- ASL does not recognize extensions for some attachments

When will ASL also detect this "old" virus?


This thread was automatically locked due to age.
Parents
  • 0
    Hi Poincare,

    i'm sure ASL will also detect the 'W32.Aliz.Worm'.
     
    Please contact our   support@astaro.com   and send them a virus infected email so we can try to reproduce your observation.
    What does "adapted /var/chroot-smtp/var/spool/qmailscan" mean?
     
    "- ASL does not recognize extensions for some attachments" : this feature is not included in version 2.0 (but in the next ;-) - we do only a virus scan for all(!) attachments.

    [ 26 November 2001: Message edited by: Markus Hennig ]

  • 0 in reply to Markus Hennig
    Ok, i see this worm is a new variant and not reported on May 22nd ...
     
    Now we got the new pattern from AVP (we are not the manufacturer of the virus scan engine!) - please update your pattern and the virus will be detected.
Reply Children
No Data
Unfiltered HTML